CVE-2026-98428: ALSA: usb: 6fire: Avoid embedded URBs

CVE-2026-98428: ALSA: usb: 6fire: Avoid embedded URBs

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb: 6fire: Avoid embedded URBs

The USB 6fire driver uses URBs embedded in different structs for PCM,
MIDI and communication, and this is basically a buggy implementation
nowadays; since a URB is managed with a refcount, this may lead to a
UAF when the URB is released asynchronously.

For addressing the problem, this patch converts those embedded URBs to
ones that are properly allocated via usb_alloc_urb().  The
pcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence
it's found in urb.iso_frame_desc[] instead.

The conversions are rather straightforward; each embedded struct urb
is changed to a pointer, and its callers are updated accordingly.
The resource for those structs are released in the common destructor
functions (usb6fire_comm_free(), etc), which are called at both the
init error path and the disconnect.

No functional changes, only compile-tested.

The Linux kernel CVE team has assigned CVE-2026-98428 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.1.189 with commit 3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a
	Fixed in 6.6.158 with commit 8b8559aeaba2e51cfee1779b2383b085991f7d81
	Fixed in 6.12.112 with commit 52a43c2d57e774489ac3fbbac06ff02f19bd9a52
	Fixed in 6.18.54 with commit 999f433c09e4668412bd68ca207ae2b4af863862
	Fixed in 7.2.8 with commit d181434549b3da668110a25d743848cce9897f4e
	Fixed in 7.3-rc3 with commit 9fe49dbc023e82dfaee7b245997d820d01742a9a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-98428
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/usb/6fire/comm.c
	sound/usb/6fire/comm.h
	sound/usb/6fire/midi.c
	sound/usb/6fire/midi.h
	sound/usb/6fire/pcm.c
	sound/usb/6fire/pcm.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a
	https://git.kernel.org/stable/c/8b8559aeaba2e51cfee1779b2383b085991f7d81
	https://git.kernel.org/stable/c/52a43c2d57e774489ac3fbbac06ff02f19bd9a52
	https://git.kernel.org/stable/c/999f433c09e4668412bd68ca207ae2b4af863862
	https://git.kernel.org/stable/c/d181434549b3da668110a25d743848cce9897f4e
	https://git.kernel.org/stable/c/9fe49dbc023e82dfaee7b245997d820d01742a9a